{"success":true,"data":{"id":"reply-to-domain-divergence","label":"Reply-To base domain differs from From address base domain — classic phishing misdirection.","description":"Reply-To base domain differs from From address base domain — a classic phishing misdirection tactic. Attackers present a trusted From identity while routing replies to an attacker-controlled mailbox. Example: From: billing@trusted-company.com, Reply-To: harvest@attacker-domain.com. Soft signal (+3) complementing the header-layer reply-to-mismatch. Fires when: Reply-To header present + Reply-To base domain ≠ From base domain + no In-Reply-To. Source: GE-R8; RFC 5322 Reply-To attack pattern; FBI IC3 BEC advisory.","tier":"warning","category":"header","isThin":false}}